What is U2F (Universal 2nd Factor)?

U2F (Universal 2nd Factor) is a universal authentication standard that provides an additional layer of security for online accounts. It’s the addition of something a user has (physical security key) with something the user knows (password). U2F, while still considered a multi-factor authentication method, is much stronger than traditional MFA methods such as security questions or one-time passwords, which can be stolen or intercepted.

The U2F standard was developed by Google and Yubico and is championed today by the FIDO Alliance, an open industry association focused on reducing the world’s excess dependence on passwords. U2F has been adopted by large services such as Gmail, Facebook, Dropbox, and GitHub.

How does U2F work?

U2F is a physical multi-factor method that provides a strong, additional layer of security to a traditional password. Entering a correct password begins the authentication process, but then a cryptographic challenge is sent to a physical device, normally a security key plugged into a USB port, where the user responds by tapping the device thus confirming the authentication process. U2F makes use of public key cryptography, storing the private key securely on the security key and the public key at the origin of service.

Advantages of U2F

1. Strong security: With a U2F security key, the user login is bound to the origin. This means it cannot authenticate to a fake site, minimizing the dangers of phishing attacks. In addition, if the device is lost, no information could be obtained such as the origin of the public key or username, in order to use it effectively. And the encrypted private key in the secure element cannot be extracted in any usable way.
2. Privacy/portability: A new key pair is generated for every service used by the U2F device. Public keys are unique and deployed for each service and not shared between providers. The physical security key can be used on public/shared computers and removed upon logout with no caching or worry about retained credentials.
3. Recovery: Users could potentially register two security keys with a service, one for account recovery, or use it in tandem with a mobile OTP for the same purpose.

Disadvantages of U2F

1. Limited support: Many websites and applications have not added support yet despite native support in major browsers and adoption by large tech companies.
2. Physical: The device has to be carried around with the user which may lead to misplacement or damage.
   

FIDO2 U2F: The Latest Generation

FIDO U2F has now evolved into FIDO2. FIDO2 extends the functionality of U2F with passwordless login flows with its main component, WebAuthn. The U2F standard remains, but has been relabeled CTAP1 (Client to Authenticator Protocol). CTAP2 was also introduced which is the same as U2F but now allows for mobile devices as external authenticators.